How do I find a short in an unpopulated 4-layer PCB?

Try the poor man's IR camera: Spray the board with cooling spray so you have the whole thing covered with tiny white ice crystals. Then run a high current through the short (plane to plane). Often you can see a spot melting where the short is - assuming the short has higher resistance than the planes (very likely).

Higher resistance => more heat (P = U*I = R*I^2).

No cooling spray in the lab? Turn the air spray can upside down - what comes out is also very cold.

Use a good volt-meter and a power supply that supports current-limiting.

Drive a decent current between DVDD and GND, ideally 100mA + up to an amp or two if the traces are decently sized.

Then, using the voltmeter, measure between closely spaced points on the DVDD and GND net, until you find the smallest delta. Your short will be close to that point.

Alternatively, drive several amps or more through the short, and look at the board with a thermal camera.

Lastly, audit your gerbers (not the board file, the exported gerbers) in a separate piece of software. There may be a problem during the gerber export.

---

Note that all of the above (except checking the gerber files) are techniques to locate a manufacturing defect, such as layer misregistration or similar. If you have a design error, I don't know what to tell you, aside from the fact that if the DRC isn't catching it, and the schematic is correct, you're probably doing something wrong.

Do you have any unplated holes or slots in the PCB's? I've previously specified some unplated holes on a similar layer stack, and found that the supposedly unplated holes were in fact plated and the plating was creating a short between the power and ground planes. A round file and a few minutes work quickly sorted the problem out.